coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Declare Engine/Lifecycle against security layer model v0.7
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Replace the gate-house review note with this repository's own declaration:
INTENT.md frontmatter, layer.yaml, and a published PEP stance map. SCOPE.md
and agent boundary docs now match that layer. The review under history/
identifies the implementation remainder; SECRETS-WP-0008 is the follow-on
workplan. SECRETS-IN-0001 is closed.

The layer is not contested. Catalog "custody" is a finding: OpenBao owns
custody, this engine owns the lifecycle API over it. SSH-CA signing is
accepted as a proposed engine API and declined as a Staff lane.

Assistant: grok
Assistant-Session: 01a04cea-cb33-7c63-bad7-c1b0f9f0076b
This commit is contained in:
tegwick 2026-08-29 11:57:47 +02:00
parent b1f0f7b666
commit 1945e16685
14 changed files with 1177 additions and 108 deletions
Download patch file Download diff file Expand all files Collapse all files

15
README.md
View file

@ -4,15 +4,20 @@ Headless, multi-application, multi-tenant secrets workflow and automation layer
for approved secret custody, delivery, and lifecycle work across build, test,
and production stages.
OpenBao remains the custody and enforcement backend. `secrets-engine` owns the
operator and agent interaction model: catalog, decision checks, plan/apply,
guarded provisioning, verification, delivery, evidence, lifecycle metadata, and
native-access deactivation. Local evidence can be inspected through an
**Layer: Engine / Lifecycle** under the accepted NetKingdom Security Layer
Model (`layer.yaml`). OpenBao remains the custody and enforcement backend.
`secrets-engine` is the deterministic API over it: catalog, decision
consumption, plan/apply, guarded provisioning, verification, delivery,
evidence, lifecycle metadata, and native-access deactivation. It does not
render authorization decisions. Local evidence can be inspected through an
allowlisted per-lane `audit` summary without exposing record detail.
## Start Here
- [INTENT.md](INTENT.md) - why this repository exists.
- [INTENT.md](INTENT.md) - why this repository exists, including the Engine /
Lifecycle declaration.
- [layer.yaml](layer.yaml) - machine-readable layer declaration and proposed
surfaces.
- [ProductRequirementsDocument.md](ProductRequirementsDocument.md) - product
requirements and MVP scope.
- [NetKingdom security infrastructure boundary pointer](docs/netkingdom-security-infrastructure.md)